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We propose a new coherent state quantum key distribution protocol that eliminates the need to randomly 
switch between measurement bases. This protocol provides significantly higher secret key rates with increased 
bandwidths than previous schemes that only make single quadrature measurements. It also offers the further 
advantage of simplicity compared to all previous protocols which, to date, have relied on switching. 
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Quantum cryptography is the science of sending secret 
messages via a quantum channel. It uses properties of quan- 
tum mechanics to establish a secure key, a process 
known as quantum key distribution (QKD) J5I . This key can 
then be used to send encrypted information. In a generic QKD 
protocol, a sender (Alice) prepares quantum states which are 
sent to a receiver (Bob) through a potentially noisy chan- 
nel. Alice and Bob agree on a set of non-commuting bases 
to measure the states with. Using various reconciliation |@] 
and privacy amplification procedures, the results of mea- 
surements in these bases are used to construct a secret key, 
known only to Alice and Bob. Switching randomly between a 
pair of non-commuting measurement bases ensures security: 
in a direct attack, an eavesdropper (Eve) will only choose the 
correct basis half the time; alternatively, if Eve uses quantum 
memory and performs her measurements after Bob declares 
his basis, she is unable to manipulate what Bob measures. It 
is commonly assumed that randomly switching between mea- 
surement bases is crucial to the success of QKD protocols. In 
this Letter we show that this is not the case, and in fact greater 
secret key rates can be achieved by simultaneously measuring 
both bases. 

The original QKD schemes in the discrete variable regime 
were based on the transmission and measurement of random 
polarizations of single photon states 0]. Other discrete vari- 
able QKD protocols have been proposed |6] and experimen- 
tally demonstrated |@] using Bell states. However the band- 
width of such schemes is experimentally limited by single 
photon generation and detection techniques. Consequently in 
the last few years there has been considerable interest in the 
field of continuous variable quantum cryptography |8], which 
provides an alternative to the discrete approach and promises 
higher key rates. Continuous variable QKD protocols have 
been proposed f or squee zed and Einstein-Podolsky-Rosen en- 
tangled states fel l Kill Ull 2lll 311 . However, these protocols re- 
quire significant quantum resources and are susceptible to de- 
coherence due to losses. QKD protocols using coherent states 
were proposed to overcome these limitations. Originally such 
schemes were only secure for line losses less than 50% or 3dB 
JT4I1 . This apparent limitation was overcome using the secret 
key distillation techniques of post-selection [15] and reverse 
reconciliation flrjll . 

In general, security in discrete variable cryptography proto- 
cols is ensured via random switching between measurement 
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FIG. 1: (a) Schematic of the simultaneous quadrature measurement 
protocol. S ± : random Gaussian numbers, AM: amplitude modu- 
lator, PM: phase modulator, X^: quadratures of Alice's prepared 
state, r\: channel transmission, N ± : channel noise, Xg. observables 
that Bob measures and iV^: Bob's vacuum noise, (b) Schematic 
of a possible feed forward attack for Eve. : observables that Eve 
measures, iVi and Ng 2 ■ Eve's vacuum noises, : Eve's electronic 
gains and Af : additional Gaussian noise. 



bases |2] or random switching of state manipulation \V, 
The random switching between measurement bases can be 
achieved simply via a 50/50 beam splitter, where the selec- 
tion of the measurement basis is chosen through the random 
photon transmission and reflection statistics. To date all con- 
tinuous variable cryptography protocols have also relied on 
randomly switching between non-commuting bases. In the 
continuous variable regime, switching requires precise con- 
trol of the phase of a local oscillator beam, which is difficult 
to achieve in practice. This local oscillator switching currently 
places a serious technical limitation on the bandwidth of cryp- 
tography protocols. In this Letter, we introduce a new coher- 
ent state protocol that does not require switching. In this pro- 
tocol, both bases are measured simultaneously, utilizing the 
quantum channel more effectively and achieving both higher 
secret key rates and bandwidths compared to previous contin- 
uous variable QKD protocols. 

The quantum states we consider in this letter can be de- 
scribed using the field annihilation operator a = {X + + 
iX~)/2, which is expressed in terms of the amplitude X + 
and phase X~ quadrature operators. In this paper, we denote 
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operators and real numbers with and without ("), respectively, 
to avoid confusion. Without a loss of generality, the quadra- 
ture operators can be expressed in terms of a steady state and 
fluctuating component as X ± = (X ) + <5X , which have 
variances of V ± = ((SX ± ) 2 ). Figure^a) shows a schematic 
of our protocol, which we term the simultaneous quadrature 
measurement protocol. Our scheme is similar to the contin- 
uous variable coherent state quantum cryptography protocols 
presented in (3. The protocol goes as follows: Alice draws 
two random real numbers S + and S~ from Gaussian distri- 
butions with zero mean and a variance of VjK She then pre- 
pares a state by displacing the amplitude and phase quadra- 
tures of a vacuum state by S + and S~, respectively. The 
quadrature operators of Alice's state are therefore given by 
= S ± +X^, where Xi^ are the quadrature operators of 
the initial vacuum state. The resulting state has normalized 
quadrature variances of = V^ 1 + 1. Alice transmits this 
state to Bob through a quantum channel with channel trans- 
mission efficiency 77, which couples in channel noise N ± , 
where the variances of the channel noise must obey the un- 
certainty relation V^V^ > 1. Bob simultaneously measures 
the amplitude and phase quadratures of the state using a 50/50 
beam splitter. The quadrature variances of the state measured 
by Bob are given by 
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By using secret key distillations protocols |4] and standard 
privacy amplification techniques |5], Alice and Bob can then 
distill a common secret key. It is possible to analyze our pro- 
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and Eve both try to infer Bob's measurement results. Al- 
ice's inference can be characterized by a conditional variance 
which is used to calculate the secret key rate. Alice's con- 
ditional variance given Bob's measurement can be written as 



min s ±((X 



g^X^) 2 }, where the gain g^ is opti- 



mized to give a minimum conditional variance of 



vZ\ B = VB-\(xtXB)\ 2 /v j 
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To calculate a relation between Alice's and Eve's conditional 



variances of Bob's measurement, V^,„ and V. 



we de- 
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fine the states that denote Alice's and Eve's inference of 
Bob's measurement, expressed as: X B , B = X B — aX B and 
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(3XJ where f3X% and aX% are Alice and 
Eve's optimal estimates with the optimal gains, a and (3 being 
real numbers. Finding the commutator of these two equations, 
and using the fact that different Hilbert spaces commute, we 
find that [X^ B ,X^ B ] = [X+, X B ] = 2i Q. This leads to 
the joint Heisenberg uncertainty relation 



Ve\ B VI\b > 1 
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Therefore, there is a limit to what Alice and Eve can know 
simultaneously about what Bob has measured. From this in- 
equality it is possible to determine the maximum information 
Eve can obtain about the state in terms of Alice's conditional 
variances V^ B . 

To minimize Alice's conditional variance for one of Bob's 
measurements, Alice can prepare and send squeezed states, 
instead of coherent states. In this case, the quadrature variance 
of the states prepared by Alice are given by — V$ + V^ z , 
where denote the quadrature variances of the squeezed 
state, and clearly V^ z > l/Vj[. Using Eqs. Q and (|2ji we 
determine Alice's conditional variance to be 
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To find a lower bound on Eve's conditional variances, we 
first consider her inference of Bob's state prior to the 50/50 
beam splitter in his station. This is given by Vj^ B , = 

min^i ((X B , — g' B X B ) 2 ), where ' labels Bob's state prior to 

the beam splitter, and g' B is chosen to minimize Vj^ B ,. Eve's 
measurement variance after the beam splitter conditioned on 
Bob's measurement, V B , B , can be expressed in terms of the 
conditional variance before the beam splitter, Vj^ B ,, as 



FIG. 2: Contour plot of the information rate for the simultaneous 
quadrature measurement protocol as a function of channel efficiency 
r\ and channel noise Vn in units of (bits/symbol) for Va = 100. 
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tocol using either the post-selection, or reverse reconciliation, 
secret key distillation techniques 1151 1 1611 . However, for sim- 
plicity, we limit our analysis to the Grosshans and Grangier 
reverse reconciliation protocol In this protocol, Alice 



where we have used the fact that Eve has no access to the beam 
splitter in Bob's station, and therefore has no knowledge of the 
vacuum entering through it. The minimum conditional vari- 
ance achievable by Alice, prior to the beam splitter in Bob's 
ts'imin) = 1/Va + (1 " V)V$ E. Using 
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this fact, and the conditional variance inequality in Eq. Q, 
we can establish a lower bound on Eve's inferences of Bob's 
measurements 



E|B(min 



> 



5((# + < 1 -* v ')" 1 + 1 ) 



(6) 




0.2 



0.4 0.6 
Channel efficiency T| 



0.8 



FIG. 3: Net information rates for the simultaneous and single quadra- 
ture measurement schemes as a function of channel efficiency, (i) 
Dashed line, simultaneous quadrature measurement, (ii) Dot dashed 
line, single quadrature measurement, (iii) Solid line, simultaneous 
quadrature measurement with feed forward attack. For a variance of 
Va = 100 with varying channel noise: (a) Vjv=1 (b) Vjv=1.2 and 
(c) Vn=2. 



The optimal information rate at which a Gaussian signal can 
be transmitted though a channel with additive Gaussian noise 
is given by the Shannon formula llisll . which can be expressed 
as / = 1/2 log 2 (l + S/N) with units of (bits/symbol), where 
S/N is the standard signal to noise ratio. This optimal net in- 
formation rate can be used to determine the secret key rate for 
our simultaneous quadrature measurement protocol, which is 



given by AI = AI+ + A/~, where A/ ± = I% A - I ± 
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with Iba(be) being the quadrature information rates be- 
tween Bob and Alice (Eve): I% A = l/21og 2 (vf /Vt B ) and 

Ig E = l/21og 2 (V^ 1 lUrjll , From these expressions, the 

secret key rate for the simultaneous quadrature measurement 
protocol can be expressed as 
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where the generation of a secret key is only possible when AI 
is greater than zero. Substituting Eq. @ with V^ z = 1 (Alice 
maximizes her information rate by using coherent states), and 
Eq. (|6j into Eq. 0, gives a lower bound on the secret key rate 
of 



AI > log 2 



(^ + (1-v)Vn)- 1 + 1 
f]+(l- V)V N + 1 
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where we have assumed symmetry between the amplitude and 
phase quadratures. Figure [2] shows the secret key rate for the 
simultaneous quadrature measurement scheme as a function 
of channel efficiency and channel noise. We see that, so long 
as the channel noise Vat is not excessive, a secret key can be 
successfully generated between Alice and Bob, even in the 
limit of very small channel efficiency 77. As the channel noise 
is reduced, or efficiency increased, the rate at which a key can 
be established is enhanced. Figure[3]compares the information 
rates of the simultaneous and single quadrature protocols as a 
function of channel efficiency for varying channel noise. The 
information rate for simultaneous quadrature measurements is 
always higher than that for single quadrature measurements, 
and in the limit of large signal variances and high channel ef- 
ficiency, it approaches double. The individual secret key rates 
for the simultaneous and single quadrature measurement pro- 
tocols can be calculated and are plotted in Fig. @- It should 
be noted that in our protocol Eve must attempt to determine 
Bob's measurements in both the amplitude and phase quadra- 
tures. This introduces an extra penalty to Eve, which is not 
included in the lower bound for her conditional variance in 
Eq. 0. Therefore, in general, Eve will do even worse than 
our analysis suggests. 

To establish an upper bound on the secret key rate, we now 
consider the physical implementation of an eavesdropping at- 
tack for Eve for our protocol. In the case where Bob measures 
a single quadrature, Grosshans and Grangier showed that an 
entangling doner attack lll6ll is the optimum attack. However, 
for simultaneous quadrature measurements, we found a more 
effective attack to be a simple feed forward attack with no en- 
tanglement as shown in Fig. [0(b). The attack goes as follows: 
Eve taps off a fraction of the beam using a beam splitter with 
transmission e. She performs simultaneous quadrature mea- 
surements on this beam, with measured quadrature variances 
of 

1 



(l- e )V* + e+l 
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She then applies the measured photocurrents back onto the 
quantum channel using electronic feed forward techniques. 
The variances of Bob's measurements can then be expressed 
as 
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where g^ is the gain of the electric feed forward, and to avoid 
detection Eve encodes additional Gaussian noise with a vari- 
ance Vj^ onto the channel. The gain of Eve's feed forward 
must be chosen carefully to ensure that the magnitude of the 
signal detected by Bob remains invariant. The correct gain 
can be expressed as = \/2(^/rj — • v /e)/v / l — £■ Substi- 
tuting this into Eq. i ll Oi l we obtain Bob's variance due to the 
feed forward attack, V^^. We can now calculate Eve's con- 
ditional variance, V^g, for the feed forward attack as a func- 
tion of the beam splitter transmission e. Ideally, Eve would 
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FIG. 4: Information rates for the simultaneous and single quadrature 
measurement schemes as a function of channel efficiency r\, with 
Vj£ — 100 and = 1. The net information rate for both schemes 
is AI = Iba — Ibe- In the case of simultaneous quadrature mea- 
surements, Ibe, the dashed line, denotes maximum information rate 
obtained by Eve, whilst I be- me dot dashed line, denotes the infor- 
mation rate obtained by Eve using the feed forward attack. 



take e — > to gain as much information about Alice's signal as 
possible. However, in doing so she increases the noise on Al- 
ice's inference of Bob's state and consequently alerts them to 
her presence. She must ensure that her attack does not change 
the magnitude of this noise. This places both lower e m i n and 
upper e max limits on the beam splitter transmission. We nu- 
merically minimize V B ^ for all e between e m - m and e max , and 
hence determine the secret key rate AJ" . The secret key rate 
for the feed forward attack is plotted in Figs. (|3} and (|4}, and 
compared with the lower bound calculated in Eq. l|8}. Fig- 
ure shows that for channel noise of variance Vat = 1, the 
feed forward information rate is higher than our lower bound. 
However, as the channel noise variance is slighty increased, 
the feed forward bound asymptotes to the lower bound calcu- 
lated in Eq. l|8). 

To summarize, we have proposed a new coherent state 
QKD protocol based on simultaneous quadrature measure- 
ments. We have calculated a lower bound on the secret key 
rate for this protocol, finding that in the limit of large signal 
variance and high channel efficiency it approaches twice that 
of previous coherent state QKD schemes. We have considered 
a possible eavesdropping attack in the form of a simple feed 
forward scheme, which has provided us with an upper bound 
on the secret key rate. An important advantage of our simulta- 
neous quadrature measurement protocol is the increase in to- 
tal bandwidth. The absolute information rate, in bits/second, 
can be expressed as / = M / log 2 (l + S/N) 11811 . where W is 
the limiting bandwidth associated with the state preparation or 



detection. Typically, in continuous variable quantum cryptog- 
raphy schemes, W can be attributed to the switching time for 
the local oscillator phase. The simultaneous quadrature mea- 
surement scheme does not require switching, so that orders 
of magnitude increases in absolute secret key rates should be 
achievable. 

In conclusion, we have shown that there is no need to ran- 
domly switch bases to achieve secure QKD. By performing 
simultaneous quadrature measurements in a coherent state 
quantum cryptography protocol, we are able to achieve a sig- 
nificantly larger secret key rate than that obtained by the usual 
single quadrature measurements. This new QKD protocol will 
allow simpler and higher bandwidth quantum cryptographic 
experiments and technological applications. 
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